Arvados

The problem here is that having access to read a Job record doesn't mean you can read the collection containing the job log. Either the log collection needs to automatically owned by the same project as the job (so that being able to read the project, which grants the ability read the job, also grants the ability to read the job) or permission to read the collection needs to be implicit through the job record "log" field of the collection (possibly a security risk if the log field isn't properly protected by API server from malicious updating to otherwise unowned collections.)

Fix by making the "show log" link non-clickable (and look non-clickable) when the log page is unreadable.

(It is desirable to support cases where a readable object has a reference to an unreadable object. The solution is to make it possible for the non-reading user to understand what's happening, and for a user who controls the sharing to anticipate when other users will get into this situation, and correct it if they choose to.)